Container Anomaly Detection via Hierarchical Temporal Memory
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The variability of software container content introduces security challenges, including the inability to verify integrity and detect malicious activity, particularly in shared computing systems, where traditional security mechanisms may be ineffective or absent, leading to risks of denial of service and malicious attacks.
Innovation Solution
A container anomaly detector using hierarchical temporal memories (HTMs) is employed to detect anomalous behavior by training on normal operation data and identifying deviations, allowing for real-time detection and remediation of compromised containers through interrupting operation, identifying potentially compromised components, and effecting redeployment or reconfiguration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If containers are used to package and distribute standardized applications, then deployment flexibility and resource sharing are improved, but security verification and malicious activity detection become difficult due to content variability
Solution Approach 1:
The patent applies preliminary action by establishing security policies and anomaly detection mechanisms before containers are deployed. The system pre-configures security policies that define expected container behaviors and pre-deploys anomaly detectors that continuously monitor container operations, enabling security verification to be performed proactively rather than reactively after compromises occur
Solution Approach 2:
The patent introduces an intermediary security policy layer between the container runtime environment and the host system. This policy layer acts as a mediator that enforces security rules, filters malicious activities, and coordinates between container applications and host resources without requiring changes to the container content itself, thus maintaining deployment flexibility while enabling security verification
2Measurement precision
If security facilities are installed within containers after deployment, then detection capability is improved, but system complexity and resource overhead increase
Solution Approach 1:
The patent extracts the anomaly detection functionality from within the container environment and places it in the host system's security module. Instead of installing detection agents inside containers, the system extracts monitoring capabilities to the host level where they can observe container behaviors through standardized interfaces, reducing container complexity while maintaining detection precision
Solution Approach 2:
The patent creates a universal security policy engine that serves multiple functions: it enforces security policies, detects anomalies, validates container behaviors, and coordinates remediation actions. This multi-functional security module replaces multiple separate security facilities that would otherwise need to be installed within containers, reducing overall system complexity while maintaining comprehensive detection capability
3Reliability
If real-time anomaly detection is implemented, then malicious activity identification is improved, but processing overhead and response time requirements increase
Solution Approach 1:
The patent applies local quality by implementing distributed anomaly detection across multiple host systems rather than centralized processing. Each host system runs local security policies and anomaly detectors that process container behaviors locally, reducing network communication overhead and enabling parallel processing of security events across the infrastructure, thus maintaining high detection reliability while preserving system performance
Data Source
AI summary
A computer implemented method to detect anomalous behavior of a software container having a software application executing therein, the method including receiving a sparse data representation of each of a: first set of container network traffic records; a first set of application traffic records; and a first set of container resource records, and training an hierarchical temporal memory (HTM) for each first set, wherein the container network traffic records correspond to network traffic communicated with the container, the application traffic records correspond to network traffic communicated with the software application, and the container resource records correspond to the use of computer resources by the container; receiving a sparse data representation of each of a: second set of container network traffic records; a second set of application traffic records; and a second set of container resource records; executing the trained HTMs based on each respective second set to determine a degree of recognition of each of the second sets; responsive to an identification of a coincidence of a degree of recognition of each of the second sets being below a threshold degree in each of the HTMs, identifying anomalous behavior of the software container.